Vulnerabilites related to SICK AG - ICR890-4
cve-2023-3271
Vulnerability from cvelistv5
Published
2023-07-10 09:26
Modified
2024-11-12 14:19
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Summary
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.
References
https://sick.com/psirtissue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfvendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonx_csaf
Impacted products
Vendor Product Version
SICK AG ICR890-4 Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T06:48:08.371Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "issue-tracking",
                     "x_transferred",
                  ],
                  url: "https://sick.com/psirt",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
               },
               {
                  tags: [
                     "x_csaf",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:sick_ag:icr890-4:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "icr890-4",
                  vendor: "sick_ag",
                  versions: [
                     {
                        lessThan: "2.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-3271",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-12T14:19:06.230650Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-12T14:19:30.590Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "ICR890-4",
               vendor: "SICK AG",
               versions: [
                  {
                     lessThan: "2.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "*",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "\n\nImproper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing\nunauthenticated endpoints.\n\n",
                  },
               ],
               value: "\nImproper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing\nunauthenticated endpoints.\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-284",
                     description: "CWE-284 Improper Access Control",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-10T09:32:48.098Z",
            orgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
            shortName: "SICK AG",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://sick.com/psirt",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
            },
            {
               tags: [
                  "x_csaf",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\nThe recommended solution is to update the firmware to a version &gt;= V2.5.0 as soon as\npossible.\n\n<br>",
                  },
               ],
               value: "\nThe recommended solution is to update the firmware to a version >= V2.5.0 as soon as\npossible.\n\n\n",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
      assignerShortName: "SICK AG",
      cveId: "CVE-2023-3271",
      datePublished: "2023-07-10T09:26:21.041Z",
      dateReserved: "2023-06-15T11:32:31.460Z",
      dateUpdated: "2024-11-12T14:19:30.590Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-3273
Vulnerability from cvelistv5
Published
2023-07-10 09:31
Modified
2024-11-12 14:17
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control.
References
https://sick.com/psirtissue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfvendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonx_csaf
Impacted products
Vendor Product Version
SICK AG ICR890-4 Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T06:48:08.408Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "issue-tracking",
                     "x_transferred",
                  ],
                  url: "https://sick.com/psirt",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
               },
               {
                  tags: [
                     "x_csaf",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:sick_ag:icr890-4:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "icr890-4",
                  vendor: "sick_ag",
                  versions: [
                     {
                        lessThan: "2.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-3273",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-12T14:17:22.856069Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-12T14:17:56.263Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "ICR890-4",
               vendor: "SICK AG",
               versions: [
                  {
                     lessThan: "2.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "*",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "\n\nImproper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP\naddress based on missing access control.\n\n\n",
                  },
               ],
               value: "\nImproper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP\naddress based on missing access control.\n\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-284",
                     description: "CWE-284 Improper Access Control",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-10T09:39:09.749Z",
            orgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
            shortName: "SICK AG",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://sick.com/psirt",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
            },
            {
               tags: [
                  "x_csaf",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n SICK recommends to disable port 2111 &amp; 2122 once the SICK ICR890-4 is put into operation.\n\n<br>",
                  },
               ],
               value: "\n SICK recommends to disable port 2111 & 2122 once the SICK ICR890-4 is put into operation.\n\n\n",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
      assignerShortName: "SICK AG",
      cveId: "CVE-2023-3273",
      datePublished: "2023-07-10T09:31:17.829Z",
      dateReserved: "2023-06-15T11:32:34.499Z",
      dateUpdated: "2024-11-12T14:17:56.263Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-3272
Vulnerability from cvelistv5
Published
2023-07-10 09:27
Modified
2024-11-12 14:18
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traffic that is not encrypted.
References
https://sick.com/psirtissue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfvendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonx_csaf
Impacted products
Vendor Product Version
SICK AG ICR890-4 Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T06:48:08.392Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "issue-tracking",
                     "x_transferred",
                  ],
                  url: "https://sick.com/psirt",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
               },
               {
                  tags: [
                     "x_csaf",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:sick_ag:icr890-4:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "icr890-4",
                  vendor: "sick_ag",
                  versions: [
                     {
                        lessThan: "2.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-3272",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-12T14:18:17.926598Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-12T14:18:45.915Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "ICR890-4",
               vendor: "SICK AG",
               versions: [
                  {
                     lessThan: "2.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "*",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "\n\n\n\nCleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a\nremote attacker to gather sensitive information by intercepting network traffic that is not encrypted.\n\n\n\n",
                  },
               ],
               value: "\n\n\nCleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a\nremote attacker to gather sensitive information by intercepting network traffic that is not encrypted.\n\n\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-319",
                     description: "CWE-319 Cleartext Transmission of Sensitive Information",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-10T09:27:46.002Z",
            orgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
            shortName: "SICK AG",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://sick.com/psirt",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
            },
            {
               tags: [
                  "x_csaf",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\nSICK recommends to disable port 2111 &amp; 2122 once the SICK ICR890-4 is put into operation.\n\n<br>",
                  },
               ],
               value: "\nSICK recommends to disable port 2111 & 2122 once the SICK ICR890-4 is put into operation.\n\n\n",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
      assignerShortName: "SICK AG",
      cveId: "CVE-2023-3272",
      datePublished: "2023-07-10T09:27:46.002Z",
      dateReserved: "2023-06-15T11:32:32.808Z",
      dateUpdated: "2024-11-12T14:18:45.915Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-35697
Vulnerability from cvelistv5
Published
2023-07-10 09:35
Modified
2024-11-12 14:12
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
References
https://sick.com/psirtissue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfvendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonx_csaf
Impacted products
Vendor Product Version
SICK AG ICR890-4 Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T16:30:44.508Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "issue-tracking",
                     "x_transferred",
                  ],
                  url: "https://sick.com/psirt",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
               },
               {
                  tags: [
                     "x_csaf",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:sick_ag:icr890-4:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "icr890-4",
                  vendor: "sick_ag",
                  versions: [
                     {
                        lessThan: "2.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-35697",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-12T14:11:42.784362Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-12T14:12:57.135Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "ICR890-4",
               vendor: "SICK AG",
               versions: [
                  {
                     lessThan: "2.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "*",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "\n\nImproper Restriction of Excessive Authentication Attempts in the SICK ICR890-4\ncould allow a remote attacker to brute-force user credentials.\n\n",
                  },
               ],
               value: "\nImproper Restriction of Excessive Authentication Attempts in the SICK ICR890-4\ncould allow a remote attacker to brute-force user credentials.\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-307",
                     description: "CWE-307 Improper Restriction of Excessive Authentication Attempts",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-10T09:35:52.067Z",
            orgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
            shortName: "SICK AG",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://sick.com/psirt",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
            },
            {
               tags: [
                  "x_csaf",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\nThe recommended solution is to update the firmware to a version &gt;= V2.5.0 as soon as\npossible.\n\n<br>",
                  },
               ],
               value: "\nThe recommended solution is to update the firmware to a version >= V2.5.0 as soon as\npossible.\n\n\n",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
      assignerShortName: "SICK AG",
      cveId: "CVE-2023-35697",
      datePublished: "2023-07-10T09:35:52.067Z",
      dateReserved: "2023-06-15T11:32:19.767Z",
      dateUpdated: "2024-11-12T14:12:57.135Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-35699
Vulnerability from cvelistv5
Published
2023-07-10 09:39
Modified
2024-10-25 19:51
Severity ?
5.3 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Summary
Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by accessing a SD card.
References
https://sick.com/psirtissue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfvendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonx_csaf
Impacted products
Vendor Product Version
SICK AG ICR890-4 Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T16:30:44.141Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "issue-tracking",
                     "x_transferred",
                  ],
                  url: "https://sick.com/psirt",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
               },
               {
                  tags: [
                     "x_csaf",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-35699",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-25T19:50:31.404610Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-25T19:51:39.248Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "ICR890-4",
               vendor: "SICK AG",
               versions: [
                  {
                     lessThan: "2.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "*",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "\n\nCleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by accessing a SD card.\n\n\n",
                  },
               ],
               value: "\nCleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by accessing a SD card.\n\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "PHYSICAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-313",
                     description: "CWE-313 Cleartext Storage in a File or on Disk",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-10T09:40:55.151Z",
            orgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
            shortName: "SICK AG",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://sick.com/psirt",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
            },
            {
               tags: [
                  "x_csaf",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\nPlease make sure that you apply general security practices when operating the SICK ICR890-\n4 like restricting physical access to the device. The following general security practices could mitigate\nthe associated security risk.\n\n\n<br>",
                  },
               ],
               value: "\nPlease make sure that you apply general security practices when operating the SICK ICR890-\n4 like restricting physical access to the device. The following general security practices could mitigate\nthe associated security risk.\n\n\n\n",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
      assignerShortName: "SICK AG",
      cveId: "CVE-2023-35699",
      datePublished: "2023-07-10T09:39:45.804Z",
      dateReserved: "2023-06-15T11:32:19.767Z",
      dateUpdated: "2024-10-25T19:51:39.248Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-35696
Vulnerability from cvelistv5
Published
2023-07-10 09:32
Modified
2024-11-12 14:38
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.
References
https://sick.com/psirtissue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfvendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonx_csaf
Impacted products
Vendor Product Version
SICK AG ICR890-4 Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T16:30:44.643Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "issue-tracking",
                     "x_transferred",
                  ],
                  url: "https://sick.com/psirt",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
               },
               {
                  tags: [
                     "x_csaf",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:sick_ag:icr890-4:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "icr890-4",
                  vendor: "sick_ag",
                  versions: [
                     {
                        lessThan: "2.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-35696",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-12T14:38:05.414683Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-12T14:38:32.412Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "ICR890-4",
               vendor: "SICK AG",
               versions: [
                  {
                     lessThan: "2.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "*",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "\n\nUnauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated\nremote attacker to retrieve sensitive information about the device via HTTP requests.\n\n",
                  },
               ],
               value: "\nUnauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated\nremote attacker to retrieve sensitive information about the device via HTTP requests.\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-668",
                     description: "CWE-668 Exposure of Resource to Wrong Sphere",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-10T09:32:57.842Z",
            orgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
            shortName: "SICK AG",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://sick.com/psirt",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
            },
            {
               tags: [
                  "x_csaf",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\nThe recommended solution is to update the firmware to a version &gt;= V2.5.0 as soon as\npossible.\n\n<br>",
                  },
               ],
               value: "\nThe recommended solution is to update the firmware to a version >= V2.5.0 as soon as\npossible.\n\n\n",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
      assignerShortName: "SICK AG",
      cveId: "CVE-2023-35696",
      datePublished: "2023-07-10T09:32:57.842Z",
      dateReserved: "2023-06-15T11:32:19.767Z",
      dateUpdated: "2024-11-12T14:38:32.412Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-35698
Vulnerability from cvelistv5
Published
2023-07-10 09:37
Modified
2024-10-25 19:51
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
References
https://sick.com/psirtissue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfvendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonx_csaf
Impacted products
Vendor Product Version
SICK AG ICR890-4 Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T16:30:44.401Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "issue-tracking",
                     "x_transferred",
                  ],
                  url: "https://sick.com/psirt",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
               },
               {
                  tags: [
                     "x_csaf",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-35698",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-25T19:50:35.574284Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-25T19:51:56.241Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "ICR890-4",
               vendor: "SICK AG",
               versions: [
                  {
                     lessThan: "2.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "*",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "\n\nObservable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login\nattempt.\n\n",
                  },
               ],
               value: "\nObservable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login\nattempt.\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-204",
                     description: "CWE-204 Observable Response Discrepancy",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-10T09:39:56.134Z",
            orgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
            shortName: "SICK AG",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://sick.com/psirt",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
            },
            {
               tags: [
                  "x_csaf",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\nThe recommended solution is to update the firmware to a version &gt;= V2.5.0 as soon as\npossible.\n\n<br>",
                  },
               ],
               value: "\nThe recommended solution is to update the firmware to a version >= V2.5.0 as soon as\npossible.\n\n\n",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
      assignerShortName: "SICK AG",
      cveId: "CVE-2023-35698",
      datePublished: "2023-07-10T09:37:22.798Z",
      dateReserved: "2023-06-15T11:32:19.767Z",
      dateUpdated: "2024-10-25T19:51:56.241Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-3270
Vulnerability from cvelistv5
Published
2023-07-10 09:18
Modified
2024-11-12 14:20
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Summary
Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.
References
https://sick.com/psirtissue-tracking
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdfvendor-advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.jsonx_csaf
Impacted products
Vendor Product Version
SICK AG ICR890-4 Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T06:48:08.407Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "issue-tracking",
                     "x_transferred",
                  ],
                  url: "https://sick.com/psirt",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
               },
               {
                  tags: [
                     "x_csaf",
                     "x_transferred",
                  ],
                  url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:sick_ag:icr890-4:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "icr890-4",
                  vendor: "sick_ag",
                  versions: [
                     {
                        lessThan: "2.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-3270",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-12T14:19:58.013611Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-12T14:20:22.953Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "ICR890-4",
               vendor: "SICK AG",
               versions: [
                  {
                     lessThan: "2.5.0",
                     status: "affected",
                     version: "0",
                     versionType: "*",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.",
                  },
               ],
               value: "Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.6,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Exposure of Sensitive Information to an Unauthorized Actor",
                     lang: "en",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-07-10T09:32:21.556Z",
            orgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
            shortName: "SICK AG",
         },
         references: [
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://sick.com/psirt",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf",
            },
            {
               tags: [
                  "x_csaf",
               ],
               url: "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: true,
                     type: "text/html",
                     value: "SICK recommends to disable port 2111 & 2122 once the SICK ICR890-4 is put into operation.",
                  },
               ],
               value: "SICK recommends to disable port 2111 & 2122 once the SICK ICR890-4 is put into operation.",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a6863dd2-93fc-443d-bef1-79f0b5020988",
      assignerShortName: "SICK AG",
      cveId: "CVE-2023-3270",
      datePublished: "2023-07-10T09:18:28.375Z",
      dateReserved: "2023-06-15T11:32:12.485Z",
      dateUpdated: "2024-11-12T14:20:22.953Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}